From Analyzing Operating System Vulnerabilities to Designing Multiversion Intrusion-Tolerant Architectures

Abstract

This paper analyses security problems of modern computer systems caused by vulnerabilities in their operating systems. Our scrutiny of widely used enterprise operating systems focuses on their vulnerabilities by examining the statistical data available on how vulnerabilities in these systems are disclosed and eliminated, and by assessing their criticality. This is done by using statistics from both the National Vulnerabilities database (NVD) and the Common Vulnerabilities and Exposures system (CVE). The specific technical areas the paper covers are the quantitative assessment of forever-day vulnerabilities, estimation of days-ofrisk, the analysis of the vulnerabilities severity and their distributions by attack vector and impact on security properties. In addition, the study aims to explore those vulnerabilities that have been found across a diverse range of operating systems. This leads us to analysing how different intrusion-tolerance architectures deploying the operating system diversity impact availability, integrity and confidentiality.

Automated Security Enhancement Framework for Linux Operating System

“…There are various ways in which vulnerabilities can be exploited. Attackers can get commands executed in the normal way, or overcome restrictions in order to gain forbidden access to data, or trigger denial of service and system service termination [21]. Every software has its vulnerabilities, and vulnerabilities occur when developers make mistakes on the logic of the coding or use imperfect validation so that the software created has an unknown weakness.…”

Formation of Cyber Security Skills Through Methods of Hacking, Bypassing and Protecting the Procedure for Granting Access in Microsoft Windows Operating System

“…It should be noted that today the Russian Federation is using Ukraine as a testing ground for testing not only new weapons and military equipment, but also new cyber warfare tactics and techniques. In response to the Russian aggression and cyber influence on Ukraine's information systems (e.g., Petya/NotPetya virus and others), the Verkhovna Rada of Ukraine passed an important law "On Basic Principles of Cyber Security of Ukraine" [1] in October 2017, which takes into account modern European expertise and principles of the cooperation In addition, different aspects of operating system vulnerabilities, hacking detection, assessing software vulnerabilities and pen-testing were research topics of B. Cannoles and A. Ghafarian [18]; A. Gorbenko, A. Romanovsky, O. Tarasyuk and O. Biloborodov [19]; Y. Khera, D. Kumar and N. Garg [20]; Y. Kolli, T. K. Mohd and A. Y. Javaid [21]; A. Luse, A. Al Marzooqта J. Burkman [22]; R. Mahajan, M. Singh and S. Miglani [23]; S. Samtani, H. Zhu and H. Chen [24]; S. Shrivastava and T. K. Ramesh [25]; D. Stiawan, M. Y. B. Idris, A. H. Abdullah, M. Al Qurashi and R. Budiarto [26]; H. Y. Xiao and B.…”

Operating Systems Vulnerability – An Examination of Windows 10, macOS, and Ubuntu from 2015 to 2021

“…According to the Common Vulnerabilities and Exposures (CVE) (n.d.), a vulnerability refers to "a weakness in the computational logic (e.g., code) found in software and hardware components that, when exploited, results in a negative impact on confidentiality, integrity, or availability." Therefore, operating system (OS) vulnerability can be described as exposures or weaknesses within an OS that allows a cyber-attacker/intruder to undermine the integrity of the OS, or any system installed on it as per [2], [3] and others.…”

“…These stages include (a) vulnerability birth or creation (the time when OS weakness is created), (b) vulnerability discovery (the time when OS vulnerability is identified by vendor) (c) vulnerability disclosure (vendor makes the vulnerability known to the public), (d) patch availability (vendor provides a quick fix to the weakness), and (e) patch installation (the public users of the affected OS install the quick fix solution to address system weakness) [9] , [11]. In [3] the author suggested an extra stage described as the "exploit stage" to be inserted between the first and fifth stages indicating that the vulnerability of the system could be exploited before the availability of a patch. They provided a clear demonstration of the vulnerability life cycle as demonstrated in Figure 1.…”

“…These risks have been given different names. The period between vulnerability discovery or its disclosure to when the patch is installed to fix it is known as the days of risk [3].The terms black risk, grey risk, and white risk are utilized to describe the awareness of the public regarding vulnerability. Black risk describes the lack of public awareness about the existence of vulnerability in the software or hardware they use.…”